Digital forensics is often used with digital devices to recover and investigate material related to computer crime. Network forensics is a branch of digital forensics relating to the monitoring and analysis of computer network traffic to, for example, gather (e.g., cluster) information and detect intrusions. Typically, network forensic approaches involve analyzing a volume of data commensurate with a determined probability of identifying a behavioral anomaly. For example, the analysis often includes the use of a behavioral clustering tools to create clustering maps of identified network behavior. Currently, such clustering tools force a selection between directional mapping models and magnitude mapping models. As such, resultant clustering maps often provide an incomplete and suboptimal view and/or analysis of potential behavioral anomalies.
It is with respect to these and other general considerations that the aspects disclosed herein have been made. Also, although relatively specific problems may be discussed, it should be understood that the examples should not be limited to solving the specific problems identified in the background or elsewhere in this disclosure.